State of SecurityConfiguration APIs in idp-profile-api

[Brent Putman]

On 12/3/13 11:49 AM, Cantor, Scott wrote:
> This is mainly directed at Brent (if he's getting email on vacation), I
> was wondering how much the SecurityConfiguration code in the IdP is
> actually "real" or if that's all preliminary.
>

Finally getting around to looking at this...

The short answer is: I'm not sure, it was done by Chad a long time ago
and I'm not sure whether and how it maps to reality at this point.

First, the underlying constituent -Configuration interfaces of which it
makes use are:  As you may remember, we split that original "security
configuration" concept into static "configuration" and runtime
"parameters" classes.  I think the parameters ones are pretty set, but
the configuration ones less so (e.g. not sure about the presence of the
credential and algorithm URIs on the EncryptionConfiguration).

But mainly I'm not sure of the when/where/how of the usage of this
actual idp-profile-api SecurityConfiguration class.  I thought probably
this was intended to drive per-RP security config.  But is this intended
to be something that hangs off of something in the relying-party.xml
(e.g. a profile config), or is it a separate layer/config file, etc?  I
can't recall that we've really hashed that out yet (or I've forgotten).